- <td><a href="[% edit_url %][% HTML.escape(row.id) %]">[% HTML.escape(row.subject) %]</a></td>
- <td>[% IF row.reference_link %]<a href="[% row.reference_link %]">[% END %][% HTML.escape(row.reference) %][% IF row.reference_link %]</a>[% END %]</td>
+ <td><a href="[% edit_url | html %][% HTML.escape(row.id) %]">[% HTML.escape(row.subject) %]</a></td>
+ <td>[% IF row.reference_link %]<a href="[% row.reference_link | html %]">[% END %][% HTML.escape(row.reference) %][% IF row.reference_link %]</a>[% END %]</td>